bert.hausmans/crewli
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security: round 1 — quick wins (rate limiting, headers, mass assignment, logging)

Browse Source 
- Add throttle middleware to login (5/min), portal/token-auth (10/min),
  volunteer-register (5/min), and invitation routes (10/min)
- Set Sanctum token expiration to 7 days
- Remove billing_status from UpdateOrganisationRequest (super_admin only)
- Revoke all Sanctum tokens on password reset
- Strengthen password rules: min 8 chars, mixed case, numbers
- Create SecurityHeaders middleware (X-Content-Type-Options, X-Frame-Options,
  HSTS, Referrer-Policy, Permissions-Policy)
- Fix open redirect on all 3 login pages (validate ?to= starts with /)
- Set APP_DEBUG=false in .env.example
- Log failed login attempts with email, IP, user-agent
- Log authorization failures (403) with user, IP, path, method
- Harden mass assignment: remove user_id from Person, audit fields from
  ShiftAssignment, system fields from UserInvitation $fillable
- Replace real DB records with factory make() in mail preview routes

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
bert.hausmans
2026-04-14 01:34:51 +02:00
parent 72120969c6
commit 1028498705
30 changed files with 235 additions and 154 deletions
Download Patch File Download Diff File Expand all files Collapse all files

77
api/app/Services/ShiftAssignmentService.php
View File

@@ -36,11 +36,13 @@ final class ShiftAssignmentService
'person_id' => $person->id,
'time_slot_id' => $shift->time_slot_id,
'status' => $status,
'auto_approved' => $autoApprove,
'assigned_at' => now(),
'approved_at' => $autoApprove ? now() : null,
]);
$assignment->auto_approved = $autoApprove;
$assignment->assigned_at = now();
$assignment->approved_at = $autoApprove ? now() : null;
$assignment->save();
$this->updateShiftStatusIfFull($shift);
activity('shift_assignment')
@@ -85,17 +87,16 @@ final class ShiftAssignmentService
if ($existing) {
$previousStatus = $existing->status->value;
$existing->update([
'status' => ShiftAssignmentStatus::APPROVED,
'assigned_by' => $assignedBy->id,
'assigned_at' => now(),
'approved_by' => $assignedBy->id,
'approved_at' => now(),
'rejection_reason' => null,
'cancelled_by' => null,
'cancellation_source' => null,
'cancelled_at' => null,
]);
$existing->status = ShiftAssignmentStatus::APPROVED;
$existing->assigned_by = $assignedBy->id;
$existing->assigned_at = now();
$existing->approved_by = $assignedBy->id;
$existing->approved_at = now();
$existing->rejection_reason = null;
$existing->cancelled_by = null;
$existing->cancellation_source = null;
$existing->cancelled_at = null;
$existing->save();
activity('shift_assignment')
->causedBy($assignedBy)
@@ -133,13 +134,15 @@ final class ShiftAssignmentService
'person_id' => $person->id,
'time_slot_id' => $shift->time_slot_id,
'status' => ShiftAssignmentStatus::APPROVED,
'auto_approved' => false,
'assigned_by' => $assignedBy->id,
'assigned_at' => now(),
'approved_by' => $assignedBy->id,
'approved_at' => now(),
]);
$assignment->auto_approved = false;
$assignment->assigned_by = $assignedBy->id;
$assignment->assigned_at = now();
$assignment->approved_by = $assignedBy->id;
$assignment->approved_at = now();
$assignment->save();
$this->updateShiftStatusIfFull($shift);
activity('shift_assignment')
@@ -177,11 +180,10 @@ final class ShiftAssignmentService
$oldStatus = $assignment->status;
$assignment->update([
'status' => ShiftAssignmentStatus::APPROVED,
'approved_by' => $approvedBy->id,
'approved_at' => now(),
]);
$assignment->status = ShiftAssignmentStatus::APPROVED;
$assignment->approved_by = $approvedBy->id;
$assignment->approved_at = now();
$assignment->save();
$this->updateShiftStatusIfFull($shift);
@@ -207,10 +209,9 @@ final class ShiftAssignmentService
$oldStatus = $assignment->status;
$assignment->update([
'status' => ShiftAssignmentStatus::REJECTED,
'rejection_reason' => $reason,
]);
$assignment->status = ShiftAssignmentStatus::REJECTED;
$assignment->rejection_reason = $reason;
$assignment->save();
activity('shift_assignment')
->causedBy($rejectedBy)
@@ -239,12 +240,11 @@ final class ShiftAssignmentService
$wasApproved = $assignment->status === ShiftAssignmentStatus::APPROVED;
$oldStatus = $assignment->status;
$assignment->update([
'status' => ShiftAssignmentStatus::CANCELLED,
'cancelled_by' => $cancelledBy->id,
'cancellation_source' => $source,
'cancelled_at' => now(),
]);
$assignment->status = ShiftAssignmentStatus::CANCELLED;
$assignment->cancelled_by = $cancelledBy->id;
$assignment->cancellation_source = $source;
$assignment->cancelled_at = now();
$assignment->save();
if ($wasApproved) {
$this->updateShiftStatusAfterCancellation($assignment->shift);
@@ -292,11 +292,10 @@ final class ShiftAssignmentService
];
}
$assignment->update([
'status' => ShiftAssignmentStatus::APPROVED,
'approved_by' => $approvedBy->id,
'approved_at' => now(),
]);
$assignment->status = ShiftAssignmentStatus::APPROVED;
$assignment->approved_by = $approvedBy->id;
$assignment->approved_at = now();
$assignment->save();
$this->updateShiftStatusIfFull($shift);